Checklist: data protection in accounting firms

☐ Have you established, for the data you receive from each client, whether you act as a processor or as a controller? art. 4art. 28

☐ Do you have a written contract or other legal act with each client that sets out the subject matter, duration, nature and purpose of the processing, the types of data, the categories of data subjects and the obligations of the parties? art. 28

☐ Do you process your clients’ employees’ data only on the client’s documented instructions, except where normative acts require you to process it? art. 28art. 29

☐ Have the accountants and other employees with access to clients’ data committed themselves to confidentiality, or are they under a legal obligation of confidentiality? art. 28

☐ Do you engage another provider that processes clients’ data, such as a cloud storage service, only with the client’s specific or general written authorisation? art. 28

☐ Do you keep a written record of the categories of processing activities carried out on behalf of each client? The exemption for organisations with fewer than 250 employees does not apply where the processing is not occasional. art. 30

☐ Are your security measures for access to clients’ data and for sending payrolls and other files appropriate to the risk? art. 32

☐ Do you treat the sick-leave certificates of your clients’ employees as data concerning health, a special category of data, and protect them with security measures appropriate to that risk? art. 9art. 32

☐ Do you notify the client without undue delay after becoming aware of a personal data breach affecting data you process on its behalf? art. 33

☐ Do you assist the client, as far as possible, in responding to data subjects’ requests, for example from its employees asking for access to their data? art. 28

☐ When the services end, do you erase or return the client’s data, at the client’s choice, and remove existing copies, unless normative acts require them to be kept? art. 28

☐ For your own employees’ data, for which you are the controller, do you have a legal basis, inform them about the processing and keep the data only for as long as necessary? art. 5art. 6art. 13